jump to navigation

CTIA, MES, MECCA Fall 2006 Roundup September 18, 2006

Posted by chetan in : AORTA, Infrastructure, Carriers, Middleware, Enterprise Mobility, Security, Federal, General, M&A, 3G, Partnership, Devices, Mobile Advertising, US Wireless Market, Mobile Content, Mobile Entertainment, Mergers and Acquisitions, Location based Services, MVNO, Mobile Gaming, Gaming, Networks, ARPU, Mobile TV, Mobile Applications, Smart Phone, Worldwide Wireless Market, Mobile Usability, Mobile Ecosystem, Microsoft Mobile, Speech Recognition, Mobile Search, Wireless Value Chain, 4G, Patents, CTIA , 2 comments

Los Angeles was the venue for the annual CTIA Wireless IT and Entertainment 2006. Pre-show events included Mobile Entertainment Summit (Chetan Sharma Consulting was a research partner) and MECCA. This note summarizes the observations and commentary from the above shows.

First let’s do the numbers. Just before CTIA, M:Metrics released some numbers from their most recent survey. Amongst the western nations, US has just over 5% 3G penetration with UK leading the way at 11.4%. Spain and France are at 8.9% and 7.9% respectively. In the US, Verizon is ahead with over 17% 3G subscriber penetration followed by Sprint at 6%. CTIA also released their survey numbers. 12.5 billion messages in the month of June 2006, up 71% from 7.3 billion messages in June 2005. There was 70% growth in service data revenues. You probably already knew most of the above after reading our research notes here and here, weeks and months ahead of the mainstream media.

MES and MECCA. The central theme from both the shows was community and advertising. The buzz shifted from “Mobile Search”, “Mobile TV”, and “IMS” during the last couple of shows to “Mobile Advertising”. The prospective lifecycle of product development goes like this – build community (whether it is around user generated content, games, artists, bands or other) and monetize the community by advertising. The permutation and combination of the business models are: free application and/or free content, subscription, earn credits for watching ads, more credits for feedback/surveys, etc. Companies who are able to build a large mobile community (at least 5-10M active users) and gather some specific demographic data become hot property of the moment. It is important to note that the mindset for an exit strategy for companies in the social media and user generated content space has changed a bit. Instead of getting acquired by software or computing companies like Google and Yahoo (yes, yes, they are media companies as well) to traditional Media companies like FOX and HBO. This was quite apparent in a number of discussions I had with the executives from new media content companies.

Enterprise focus, Finally!. I have been involved in the mobile enterprise space since 1999 and have been coming to the CTIA for a number of years. The fall show is supposedly about dual personalities of Entertainment and Enterprise. For the first time it felt that the Enterprise side was given its due respect and was on an equal footing to its sibling personality - the glamorous, the attention-seeking “Entertainment”. CTIA started the conference with an Enterprise panel discussion (of course after the surprise Governator keynote). Though the discussion was too high-level to provide any key insights, CIOs confirmed what is well known now that the spending on wireless-data related projects is going up significantly. A surprise revelation was that China’s growth in enterprise solution is among the highest in the world. It is all about productivity and ROI. Companies are also looking to outsource their IT operations related to wireless devices. Handset guys are coming out with Enterprise targeted devices though we are still in the very early stage development of the cycle. Throwing an email client on the device doesn’t make it an enterprise device. Email client is a given in all new handsets now. When will we start seeing embedded enterprise apps? Mobile web services clients and frameworks?

It’s an Ad, Ad, Ad, Ad world. Mobile advertising is clearly the buzz of the moment. Everyone wants to build an ad-supported model and also build their own ad network. Currently, most of the talk is around simple rotation of ads or tying ads to the category the user is interacting with. Not much attention on demographics, profiles, or context. That’s where the “big” impact and value will come into play. Currently, carriers sit on goldmine of user data that is begging to be leveraged for enhancing user experience. Unexpectedly, they sit on a big opportunity that will start to change the advertising industry over the course of the next 5 years. To see where things are going, we just need to look at trends in Japan and Korea. It was interesting that in almost all of the mobile advertising discussions, nobody talked about the elephant that was not in the room - Google, trendsetter in monetizing content. Also, missing were the agencies and their perspective. I have looked at this space quite a bit over the last two years and while agencies are excited about the prospect, they are not ready to jump yet. It will be quite entertaining to watch the new-generation media companies compete/collaborate with the carriers. For the next 3 years or so, carriers will still have an upper hand and if they execute it right, could dominate the space for a long time to come. People also talked about different types of ads – IVR, Voice, Interstitials, banner, in-game, before-and-after, etc. Of course, click-to-call or click-to-action are going to be an especially important ingredient of this game. Sprint Nextel and Enpocket announced their mobile advertising program. Amp’D also announced mobile advertising plans with Rhythm New Media. Bango launched its Ad initiative as well. Virgin mobile’s Ad program “Earn Airtime in Your Spare Time” is innovative. They are truly in tune with their subscribers.

FMC. Kyocera had some trial handsets that supported WiFi/VoWiFi. One could theoretically make VoIP calls and download content over WiFi but will carriers allow it and how long will they resist. Non-traditional carriers like the MVNOs and the cable operators are very interested in exploring bundling offers. Sprint also announced EV-DO Rev A data cards that provide data rates up to 400-600kpbs. Cingular announced that they will have a majority of the top 100 markets deployed with UMTS/HSDPA by year-end. However, the choice of handsets is still missing and as such adoption for Cingular is behind schedule.

4G. While, we are just starting with 3G (except Japan and Korea), seven of the wireless industry’s leading carriers have joined forces to “develop a common vision” for the future of mobile networks technology. Members of the Next Generation Mobile Networks initiative include China Mobile, KPN, NTT DoCoMo Inc., Orange, Sprint Nextel Corp., T-Mobile and Vodafone. The group said it has created a set of requirements “for a future wide area mobile broadband network designed to offer enhanced customer benefits by delivering competitive broadband performance alongside high levels of interoperability.” In plainer terms, the NGMN appears to be devising a roadmap for interoperable 4G networks. You can sense the arm-wrestling to come. 4G could end up having some serious IPR issues if all major patent-holders don’t participate. The 3GPP licensing regime has been a failure, industry needs to be proactive, dedicate resources to the problem and get is solved to the extent it can.

Telematics. The number of firms talking about telematics or navigation on the phone or devices for your car increased quite a bit. Navteq, TeleAtlas, TeleNav, Inrix, Pharos, Kore, Teydo, and many others displayed their wares. On the consumer side, navigation is getting embedded into Local search apps which are enhancing the user experience quite a bit. FindIt and Google Maps are two examples. There were enterprise focused solutions from Tierravision, LiveCargo and @Road.

WiMax. Spent sometime with Lars Johnsson, VP at Beceem Communications talking about the prospect of WiMax worldwide. Clearly, Intel and Clearwire’s announcement has reenergized the industry and taken some uncertainty out. Lars is extremely knowledgeable person on everything WiMax. He co-founded Flarion which got sold to Qualcomm last year. It looks like the benefits of 802.16e will render 802.16d useless in short order. “e” provides better link capacity, Forward Error Correction, power efficiencies, and optimization. The cost of building a WiMax modem is lower than the WCDMA counterpart. A number of cable and wireline players are looking for triple-play offerings. Beceem has strong partnerships with OEMs worldwide and is actively involved in several trials in Korea, Taiwan, Japan, India, and US. The biggest challenges are around interoperability (as always) and quick resolution of IPR issues. From an application perspectives, gaming companies are the ones watching it closely. Also, automobile media player vendors are interested in using WiMax for Broadcast video. Tropos believes that Mesh technology will continue to have relevance in a WiMax-enabled world as the practical ranges of base stations won’t exceed 5-10miles.

M&A. Some major M&A news at the show– Real acquiring WiderThan for $365M, Lucent acquiring Mobilitec for undisclosed amount, and FOX acquiring 51% stake in Jamba for $188M. This follows Sybase’s acquisition of Mobile365 last week for $400M. There are several factors at play. Clearly, some segments of the industry that have matured are facing price pressure and hence consolidation. Media companies are also realizing the potential and don’t want to miss out or get behind the curve so acquiring companies that have traction, not necessarily the best technology. Some of the valuations just don’t make sense but I guess some over-exuberance is to be expected at this time.

Handset launches. You might have missed the announcement; there was no Steve Jobs, no iPhone release. Pearl was probably the highlight of the show though plans had been leaked in the media sometime back. RIM has Razresque aspirations from the device. The big three didn’t have anything interesting. Nokia launched E62 (thankfully, taking a cue from Motorola, they are getting rid of their number scheme), however it is missing 3G and WiFi support of its European cousin E61. Kyocera had some interesting devices as discussed above. Sprint launched two EV-DO Rev A data cards from Pantech and Sierra Wireless. Cingular announced a $150 HTC Smartphone. Linux handsets are also on the rise. Obigo/Teleca had some nice tools/products for mobile Linux – Browser, IM, Media and Email client. The user experience was quite nice.

Mobile TV/video. At the last two shows, Mobile video and Mobile TV were all the rage. The solutions seem to have matured though uncertainty of its success remains (primarily around time-horizon to success). There are too many providers in the space offering solutions from individual codecs to end-to-end solutions, do-it-yourself toolkits (Nexage) to user-generated video solutions (ComVu, Juicecaster – ComVu’s one click mobile broadcast capability was pretty good) to niche demographics (Viva Vision is getting good traction in the Latino market). Various pieces of the mobile video puzzle have been commoditized, now, it is all about packaging. There were a number of Mediaflo handsets on display as well. The quality of Broadcast is really good. I saw some Broadcast TV services in Seoul earlier this year and the user experience is pretty good. My partner watched the entire South Korea soccer world cup game on his mobile device as he wasn’t near a TV. Once the market gets seeded with enough phones and service pricing settles to mass-market scale, we can expect good adoption rate for such services. Imagination Technologies out of UK showed some innovative SoC (System on Chip) solutions targeting Mobile Broadcast video. Some new names in the space are QuickPlay, Picsel (nice user experience), and Convisual. Expect some consolidation in this space over the next 12 months.

The ecosystem friction. The mobile data ecosystem tension is bubbling up. Carriers want control (some more than others) so that they can manage user experience and minimize customer support calls. Content companies want to bypass the carrier and go direct to the consumer. This was also evident in the Walt Mossberg’s grilling of the carriers as well as other conversations with participants in the value chain. Things are improving but not at the pace everyone would like it to be. Clearly, ecosystem only proliferates if it is allowed to make money. If certain sections of the chain get strangled, holes start to develop which pollutes the system.

User experience. Didn’t see much progress on the UX front. Saw a cool implementation from FAST for Optus in Australia where they used search technology to populate the Active Screen with user preferred content. Optus has been using this offering to entice users to 3G as it is not available on lower bandwidth network and is apparently having good success. Add context and some multimedia and it becomes very very compelling. It is one area that hasn’t been exploited that much yet. In the US Cingular’s MediaNet implementation uses the same concept but is more browser-based. In different sessions, carriers agonized over limited shelf space and mountain of content. That’s why man invented “mobile search”. The concept of “deck” is very limiting. Content needs to get exposed via search whether it is post-query or pre-populated dashboard based on context and preference.

Test equipment – Whether it is entertainment or enterprise, very little attention is given to testing and monitoring data applications and services. Keynote launched a really useful product offering (Mobile Device Perspective) that enables developers to test their app from distance on a live network and live devices and control it through manual steps or automation. Currently, such testing is done by flying a team of testers, test, and optimize. This offering can reduce the cost of such operations. I took a look at their R&D and test setup and found it quite compelling. TestQuest also showed a product along the same lines though it is more of a platform play than a service offering.

MVNOs. There is a realization that MVNO business is hard. The unrealistic expectations for customer growth are being recalibrated. It is still a viable business model but one has to give time and execute like a carrier. Virgin Mobile noted that it requires at least 2M subs before a nationwide MVNO (in the US) will cross the line from red to black.

IMS. Talked to Lucent and NMS about their pre-IMS solutions. NMS was displaying a technology around P2P mobile video sharing while talking (though the tasks happened in time-slice mode). Lucent had a solution “extensions” which converged PBX and Mobility. An example would be you dial a 4 digit extension on your mobile phone that connects you to the other party as if you dialed it from your desktop phone. BUT, networks aren’t there yet and devices will arrive a bit later. In the interim, companies are looking to stimulate the simulated IMS experience.

Funding news. Several funding news from the show, the one that caught my eye was $10m for Bubble Motion in VoiceSMS (funded by Sequoia Capital). It should be noted that there is prior art in this space and the likelihood that the company is infringing on somebody’s patents are high.

Coolest gadget. MyVu’s media viewer

Coolest booth. Infospace’s Tony Hawk show was probably the most exciting thing happening on the show floor. Watching the masters go swing-swong had the crowd go wild with ooohs and aaahs.

Misc. News.

Your comments are always welcome.

CTIA and Mobile Entertainment Summit Roundup April 10, 2006

Posted by Chetan in : AORTA, Infrastructure, Strategy, Carriers, Middleware, Enterprise Mobility, Security, Speaking Engagements, Federal, General, M&A, 3G, Partnership, Devices, Mobile Advertising, US Wireless Market, Mobile Content, Mobile Entertainment, Mergers and Acquisitions, Mobile Wallet, International Trade, Location based Services, Usability , add a comment

My week started with a presentation on “US Wireless Market: Trends, Technologies, and Opportunities” to the CTIA-bound Japanese delegation that included very knowledgeable executives from NTT DoCoMo, KDDI, Kyocera, Mitsubishi, Base, MCPC, Vodafone, and Willcom. During networking, had some interesting conversations with our Japanese friends regarding content business, UMA, WiMax, 4G, and new business models.

Spent next three days attending Mobile Entertainment Summit (April 4th; Chetan Sharma Consulting was research partner for the event) and CTIA (April 5-7th), talking to companies, looking at demos, visiting with colleagues and friends, and just absorbing the atmosphere and distilling things down to “what does this mean?” Below is the summary of key observations, thoughts, and digressions.

General atmosphere – As expected, the show grew bigger in terms of attendees (over 40K) and exhibitors marked by return of double story booths, glitz, and million dollar marketing budgets. Samsung and LG clearly were dueling it out for the most recognized brand out there trying to out-do each other in invoking a subliminal conversation with the customers. There was tremendous excitement at the opportunities, fear of missing it out, and yearning for figuring things out to ride the wave.

Booth of the show award is a tie between LG and Motorola with Samsung close behind. Honorable mentions: Philips, Lucent, and Siemens.

Typically, the main CTIA show focuses a lot on infrastructure, middleware, network, and handsets. This time, it was also about applications. There are readjustments going on in the value chain and with the looming consolidation wave, the rubric cubes will be rearranged in several sub segments. Wireless email had already starting shifting that way even though we are below 10% penetration.

Convergence was a big theme of the show. Consulting firms Deloitte and PwC released their reports on the subject and every major infrastructure player was talking about the impact of Fixed-Mobile Convergence (FMC). Convergence across PSTN, Cellular, WiFi, Bluetooth, Cordless Telephony Profile (CTP), Unlicensed Mobile Access (UMA), Session Initiation Protocol (SIP), IP Multimedia Subsystem (IMS), and Digital Living Network Alliance (DLNA) were all discussed in some detail. From a consumer point of view, it comes down to how fast the network is upgraded to provide the functionality and the number of devices in the market to take advantage of the feature-set at reasonable prices. Until then, it is just talk.

Positioning – Several companies are coming around to what DoCoMo taught us about i-mode. It was all about – improving the life experiences of customers. Nokia’s tag line changed from “voice goes mobile” to “life goes mobile” and “work goes mobile”. MTV expresses itself as a “content experience” company. Microsoft is all about “Discover, Innovate, Deliver” while Motorola wants to produce “must do” experiences.

Mobile TV is another area that is priming up for some consolidation as various components are commoditized (esp. for Unicast). It is not that, we are done with the innovation in this segment, in fact, we are only getting started, however, the drive will come from how the video content is packaged with other pieces of content and applications and made more interactive with humans and machines. The number of companies in the space almost doubled since last show (Ortiva, VectorMax, Snell & Wilcox, NMS, Nexage, Vimio). Everyone agrees that MobiTV has a huge advantage. It is a good case study of “first mover advantage”. It will be interesting to see if they can build on their success and compete effectively against broadcast solutions. Broadcast is the future of MobileTV. Mediaflo rocks. Key questions are: can the carriers get the business model right at launch that promotes usage and will the political and regulatory climate foster Mediaflo growth in light of DVB-H (Modeo in US) and DMB. Japan, Korea, and US are fertile ground for this battle. Qualcomm is working on Mediaflo as well as DVB-H chipsets. Slingbox was also showing their place-shift mobile video solution. It will be interesting to see how carriers block-and-tackle this one.

AORTA and 3G revisited – Since the article “3G – Hitting the Mass Market”, the tipping point assessment has been validated by several other analysts. In US and Europe, 3G deployments will start hitting critical mass in the first half of 2007 and we are getting closer to the vision of Always-On Real-Time Access (AORTA).

Mobile Search – During last couple of CTIA shows, mobile search has been an upcoming thing. During the last six months, 3 of the top 5 carriers have launched mobile search solutions with some incredible returns and actual impact on the bottom-line. Some branded solutions have also been launched and various business models are being tested. One can feel the tension between carrier-branded search and solutions from the likes of Google, and Yahoo. Who can build a better mouse-trap? Will carriers cede control and help non-carrier solutions with carrier-resident data? Feature-set is straightforward. Question is what customer data can one use to enhance the user-experience. If carriers are smart about it, they will work with white-label vendors such as Infospace (also Medio, Jumptap, etc.) to develop some really neat analytics that feeds back into user experience. Voice search solutions are also becoming more prominent. In the last 6 months, Voicebox, Voicesignal, Promptu, and V-enable have announced voice search solutions.

User Interface is getting better – Players in the value chain are paying more and more attention to the user-experience. As predicted, MVNOs are having an impact on how device manufacturers and carriers think about customization. Amp’D, ESPN, Disney, and Helio all have custom clients. Rather than relegating the user experience on device browser and archaic transcoding solutions, these MVNOs want to provide a controlled and immersive user experience. With 2nd tier device guys eager to do what-ever-it-takes to make the user experience attractive, mainstream device manufacturers and carriers will need to get their acts together in a hurry. Verizon’s announcement (about using Flash) is recognition of this trend. Also, there were some apps with really cool UIs from startups such as DSI.

Community and User-generated content – There was tremendous activity in the mobile community and user-generated content space, from blogs and SMS to video and music content around community networks. Indeed, it is all about communities and user-generated content plays an incredibly important role in it. Though we have seen significant amount of growth in ringtones, graphics market, this will explode when UGC (including music, video) is put into the mix. This has been validated by multiple data points, the newest one being from 3 in Europe through seemetv service. How quickly will carriers embrace this so that the poor schmuck with 10 goofy videos with no technical capability gets to put their content for sharing, for barter, or for sale. Companies such as Intercasting, Juicewireless, AirG, SMS.ac, Bango, Blogstar, Helio (Myspace) are coming at the opportunity from different angles.

MVNO launches Since last CTIA, ESPN Mobile and Amp’D have launched. This CTIA marked the launch of Disney Mobile and the concept resonated with most attendees esp. folks who have kids. They also got their handset strategy right by pricing it for mass consumption. Service will become available in June. Helio is supposed to launch around the same time. In the meantime, Vegas started taking bets on which MVNO will be the first to fold. As I have discussed in prior articles, MVNOs have clearly raised the bar on user experience and will continue to push the envelope. The willingness of Asian manufacturers to customize at a frantically rapid pace is going to put pressure on the big boys and is already having an impact on their strategy and roadmaps.

Enterprise – Though there were a couple of Enterprise pavilions, the substance was pretty light. Revenue potential of enterprise solutions is equally big if not bigger than the consumer segment, yet it fails to get attention beyond mobile email which itself is becoming a commodity play. It should be noted that there were a couple of vendors that are trying out new approaches to the consumer email such as using MMS for email (Memova).

Mobile Diagnostics and Performance measurement – With the advent of 3G and numerous data apps, the impact on network storage and performance is enormous but is often not talked about. The amount of bytes generated in 3G networks is many times more than 2G and 2.5G networks. As such, the networks need to be planned and monitored appropriately. Testing and simulation of applications, services, and handsets also become more important. Companies such as Vallent, EMC, Keynote, Schema, and Argogroup are looking at the problem from different angles.

4G – Though no body in the industry agrees what it is, some semblance of “Beyond 3G” solutions started showing up at the show from IMT-Advanced solutions from DoCoMo (1Gbps) to WiMax pavilion. Samsung had the WiBro gear at the show – handsets and infrastructure – very cool to see things end-to-end. WiBro trials are ongoing in Korea and we are likely to learn a lot from the results that will help decision makers in the WiMax segment. However, we are still a long ways away (2008) before we see any meaningful mass market penetration for mobile WiMax (There are a number of trials going on around the world from DoCoMo, Willcom, Softbank, KDDI, Sprint, SKT, and KT). It should be noted that US spectrum auction is slated to start June 29th, 2006. It will be interesting to see who ends up with what esp. Clearwire and if any of the non-traditional players such as Google, Disney, DirecTV, and Microsoft make a run for it.

Near Field Communications (NFC) – DoCoMo has had success with FeliCa (Sony’s technology) launch in Japan. Things are increasingly looking bright for NFC-based solutions (mobile wallet, venue check-in, authentication, etc). Mastercard is running some trials on East coast. Cingular has been running some trials in Atlanta area using Nokia phones with Philips NFC technology. In addition to contactless payment capability, NFC-equipped phone can also read data from compatible tags, opening new content discovery avenues. The biggest challenge is of course getting the required infrastructure in place and endorsement or participation by at least one or two major retailers such as Starbucks or McDonalds. Many companies from Philips to smaller players such as MobilyT had neat NFC prototypes. Paypal also launched its mobile payment solution. Many companies are looking to bypass carrier billing so they have more control – it will be an interesting battle to watch.

M2M – With most major western markets reaching saturation, focus has been shifting to M2M applications and device-to-device networking. In addition to the big players such as Siemens, Motorola, and Phillips, newer players such as Esmertec were discussing the potential and applications.

Chinese presence – In the CTIA roundup one year back, I noted “Chinese are coming”. If there was any doubt, it was pretty clear from this show that Chinese wireless players are going to be significant force to reckon with. They are already making an impact in markets outside China, such as in India, Eastern Europe, and Latin America. Booths and showcases from ZTE, UTStarcom, and Huawei rivaled their western counterparts. Noticeably, several software and SI Indian firms also had presence at the show.

Handset business will continue to be brutal. Samsung, LG, Motorola, and Nokia all had a good line up of new handsets. Chinese manufacturers such as Techfaith wireless and Amoi also had some sleek handsets on display (Amoi even had knock-offs of Razr and iPod phone)

Mobile Advertising – Not much substantive progress since last time, except for more talk, and more companies popping up. The concepts and business models are starting to get more serious discussions from carriers, content providers, aggregators, and advertisers. Some interesting ad performance tools are also coming up (Integrated Media Measurement Inc.). It comes down to who has the relationship with the customer, what’s the depth of consumer profile information, and the trust-level established with the customers. ActionEngine’s MSNBC launch, new startups Rhythm NewMedia and VibesMedia, and Free DA (supported by Ads) were among the highlights in this area.

Location Based Services – I remember working on LBS solutions back in 97-98 timeframe and the technology was going to change the world (in the US). Largely due to FCC’s inability to enforce its own rulings, we didn’t see much progress for a number of years. Though Nextel has been providing LBS in the enterprise sector, it was only recently with Sprint opening up its APIs for selected developers that we are seeing some LBS based apps for the consumer sector e.g. FindIt. Disney Mobile is also making location a key feature of its offering for kid-tracker types of apps.

Microsoft dominance starts – It has taken a number of years, but shift is noticeable now. With smart phones penetration increasing, Microsoft is starting to dominate the high-end market. A good percentage of new smart phones are running MS software though Linux is also making some inroads in this market (DoCoMo, China). If the battery power issues can be resolved and the OS moves into the sub-$200 market, it will accelerate MS’s dominance of handsets. There was also talk about Opensource OS for mobile devices.

Open gardens – Pretty soon, being “open” will be considered a competitive advantage. At the two extremes are T-Mobile International (which gave up and opened up its greenhouse to the likes of Google) and Verizon (which might be one of the last ones to open up its nursery). Then we have carriers such as Cingular who are slowly but surely opening up access and getting closer to the i-mode model (e.g. recent Myspace announcement)

Misc. – Impatica was showing their solution of running PowerPoint from blackberry. Pretty slick and easy. Another interesting app I learned about was that of using SIM as a token generator for authentication. This can be really handy for corporate security.

Later this week, I am leaving for Korea to meet with some really smart guys in the wireless industry and experience the wireless broadband capital of the world first hand.

Your comments are always welcome.

Copyright, 2006 Chetan Sharma Consulting. All Rights Reserved

FCW Wireless Security/RFID Conference Roundup March 1, 2006

Posted by Chetan in : Infrastructure, Enterprise Mobility, Security, Speaking Engagements, Federal , 1 comment so far

Once or twice a year, I get a chance to look at wireless issues in the federal sector, hear and talk to CIOs and executives of various government agencies such as DHS, DOD, GSA etc. It provides a unique view into a different world that is both impressive and befuddling at the same time. Though there are similarities to the Enterprise Mobility segment, it is a difference universe where things are driven by mandates and missions, directives and discourses. While there is a sense of urgency, there is also stifling bureaucracy and ineptitude.

I made my annual pilgrimage to Federal Computer Weekly’s (FCW) Wireless Security and RFID Conference in Washington DC earlier this week (courtesy of Compubahn). Also, spent some time at an event on Capitol Hill hearing some of the CIOs and their underlings on their future IT plans. At the conference, I got an opportunity to moderate a very knowledgeable panel on wireless security matters. We will get to the panel discussion a bit later.

I think it is quite relevant to discuss federal wireless related issues within the enterprise context as there are several lessons to be drawn it can help various organizations who are going through some of the similar challenges or are simply unaware of the problems they have. The most fundamental problem that most agencies (and by the same token most companies) have is lack of a coherent and detailed wireless security policies that considers “all” wireless devices whether they are operating within a WLAN that is controlled by the entity or for the device that is using a foreign network to access internal resources or for the device that is not connected yet but has significant and sensitive information stored on the device. How do you manage these devices? What if the device gets lost or hacked? Is the data encrypted? Does the data that gets copied on the SD card encrypted? How is the policy enforced? Can you use the same policy enforcer that you use for LAN on wide range of devices - PDAs, Symbian phones, BREW devices, etc. What’s the policy on Bluetooth? Do you permit Bluetooth devices in your enterprise? (in some agencies, Bluetooth enabled devices are not procured at all) Are you aware that there is no encryption? What ports get disabled and when? There are plenty of questions but no clear answer. For government, a good starting point is DOD wireless security policy (8100.2). Any enterprise who hasn’t really laid out their wireless policy could benefit from the same as well.

However, the policy needs to be laid out with plans that take into account scenarios 2-5 years from now. The reality today will get outdated really fast and for sure before your current implementation gets done. Once you have the policy, then what? Well, Audit and Enforce it.

One of the keynotes was given by Ron McKenzie who is the point person for American Red Cross IT and wireless implementation (disaster and rescue response units deal with wireless technology and related applications all the time) and reports to SVP and CIO Steve Cooper. He discussed the challenges that Katrina posed to the operations, logistics and IT. The main technology used are Satellite, 2way radios, and Cellular. The main applications are registration, family linking, bringing shelters online, and connecting with financial institutions to issue cards. One of the biggest challenge is scaling up and down of operations. As we are painfully aware - Katrina was a shameful disaster of significant magnitude. One of the basic problem was that communication (ok, so it is not that basic) was woefully lacking. Wireless industry clearly responded well but we could do more. The initiative really needs to come from Red Cross. Ron was looking for feedback from the industry as how they can improve their solutions and processes to better address emergency needs and minimize discomfort and chaos. I bet there are a number of people reading this who have great ideas or experiences that can help in pushing the dialog further. Red Cross is planning to finalize its “lessons learned” booklet by July 06 and thus prepare a process plan that can be replicated in the event of similar or worse disasters in the future. You can help. If you have ideas on emergency preparedness and execution, please send them along and I will compile and pass them on to Ron who has promised to give good consideration to all proposals. A few months back, Tsunami in SE Asia created damage and destruction of epic proportions. I always wonder as to how can the technology be applied to reduce the impact of natural disasters or make rescue and recovery operations more tenable. But, it is clearly not the technology that is a challenge but the people who use (or don’t use) it to streamline the processes. With Satellite, WWAN, WLAN, WPAN technologies, there isn’t a place on earth that can’t have connectivity for communication or data exchange.

One of the more telling problems (and I see this echoed in the commercial world as well) is the lack of user input into solutions or product roadmaps. There are plenty of vendors who are touting cutting-edge solutions to various agencies but they are selling to buyers and not users who typically are busy doing the real work.

My wireless security panel “Technology Fundamentals for End-to-End Security” constituted of Sumit Deshpande, VP, Wireless, CA (Computer Associates), Dean Knuth, National Manager, Northrop Grumman, and Jeff Watts, Sr. Engineer, Smartronix. These guys have dealt with very strict security requirements for most of major agencies esp. DOD. I asked the panel “Is security a technology issue?” Answer was an emphatic NO. Security is a process in which technology plays an important role. Education, training, awareness, audit, and enforcement are as or more critical than the technology implementation of whatever solution you might have. Bruce Schneier explains this in his books and articles better than anyone else.

There has been a lot of talk about 802.11i (WPA2) standard which is supposed to be a lot more secure than current WPA/Tkip implementations. Device management and device security is an important issue that is mostly overlooked. The other aspect that is hardly considered is that there is more to security than just LAN/WLAN - WWAN and WPAN powered devices all need to be managed if security is a concern. Though it hasn’t been a big issue yet, wireless security issues will become important for Sarbanes Oxley compliance as well. How does company keep track of corporate SMS/IM/data on wireless devices? Can it be audited? What are the risks? What are controls in place? Another point to remember - though FIPS 140-2 is becoming the norm for encryption, the certification process is arduous, so plan accordingly.

Amid the discussion about security, one can also go overboard in cases where information being transmitted or stored isn’t sensitive and security provisions only help in alienating the user and they get fed up of the steps required, reduced speeds and investment goes by the way side. Security to some extent is also a balancing act of user convenience and corporate priorities.

There seems to be a trend that CIOs of various agencies are coming from the industry these days. I think a great trend but there are many agencies that lack leadership and initiative and still rely on the big consulting companies to run their shop.

RFID - A good overview report can be downloaded free of cost here

Though there are a lot of privacy and security concerns (just like for Bluetooth), consider the following:

  2005 2010 2015
RFID Tag Pricing $0.23 $0.06 $0.01
Number of RFID Tags in Use 6.3 million 80 billion 10 trillion
Growth of overall RFID market $3 billion $10 billion $25 billion

Source: IDTechEx (2005)

RFID (and similar WPAN technologies) are going to be pervasive. Applications range from logistics to defense. Though I have been skeptical, human implants are also showing up. Recently a senior executive at one of the biggest software company I was working with told me that I am underestimating the growth in RFID implants in mobile workers in the next 5-10 years. Maybe there is a point, time will tell.

Also, ran into Iridium booth. I thought the company evaporated after their spectacular flameout but they are still hanging their hat and focusing on government, public safety, and on workers that require remote coverage.

My colleague and friend Sunil Jain raised a few interesting questions recently. Right now there are vendors like Symantec who license and manage security and policy on desktops and laptops and then you have vendors such as Pointsec, Mobile Armor, Credent and host of others who focus solely on the wireless device space. With the two worlds converging rapidly, how soon before an enterprise asks Symantec to add a few hundred licenses to their agreement to cover mobile devices as well. Do the (now) niche players get gobbled up by the big boys? or would the reverse be true? Likewise, how do you extend your HP Openview, CA Unicenter, BMC Patrol, or IBM Tivoli to do wireless device management as well. Also, whose responsibility is security anyway? OS Vendor, Handset guys, Network or carrier, enterprise (consumer?). And along the same lines, should security be handled at the network or at the device level? Gartner advocates network level protection. They contemplate that mobile world shouldn’t follow the PC deployments of anti-virus and other risk mitigation tools but rather network should have these services and only go to devices as a last resort. I think both are required, because there are is so much that can happen in a disconnected (from the enterprise but still connected) mode.

For most new technologies or products, security is generally an after-thought. We as an industry need to get better at designing systems, protocols, and technologies with security built-in rather than going through the alphabet soups of new versions to patch-up the mess.

Another area that is gaining traction is the concept of Managed Security. Security is getting complicated and so companies rather than deploying staff are interested in outsourcing device management and security of their mobile assets. Would you do it?

Finally, there are several other interesting federal initiatives like Location Specific Digital Signature (LSDS) and WiMax development work with Intel, Integration of RFID with WLAN, Biometrics, Locating users using WLAN/WPAN. These will trickle into the commercial sectors in the next 2-3 years.

 Your comments are always welcome.